| AArch64 | |
| ppc64le | |
| s390x | |
| x86-64 |
- Upgrade to upstream version 4.1.136
* Security fixes:
+ CVE-2026-44891, bsc#1271435: memory exhaustion in
io.netty:netty-codec-stomp
+ CVE-2026-55833, bsc#1271961: zip bomb in
io.netty:netty-codec-http
+ CVE-2026-59921, bsc#1272307: improper CR/LF neutralization in
io.netty:netty-codec-http (multipart)
+ CVE-2026-59919, bsc#1272305: improper CR/LF neutralization in
io.netty:netty-codec-haproxy
+ CVE-2026-55851, bsc#1272253: memory exhaustion in
io.netty:netty-codec-haproxy
+ CVE-2026-56745, bsc#1272254: memory exhaustion in
io.netty:netty-codec-http
+ CVE-2026-56817, bsc#1272257: insecure defaults in XML parsing
in io.netty:netty-codec-xml
+ CVE-2026-59899, bsc#1272301: memory exhaustion in
io.netty:netty-codec-http
+ CVE-2026-56818, bsc#1272603: memory leak in
io.netty:netty-codec-redis
+ CVE-2026-56819, bsc#1272258: memory leak in
io.netty:netty-codec-http2
+ CVE-2026-55831, bsc#1271960: resource exhaustion/DoS in
io.netty:netty-codec-http
+ GHSA-mfg7-5gfp-c4w3, bsc#1272519: memory leak in
io.netty:netty-codec-dns
+ CVE-2026-59901, bsc#1272304: infinite loop in
io.netty:netty-codec-compression (bzip2)
+ CVE-2026-59900, bsc#1272303: improper header neutralization in
io.netty:netty-codec-http2
+ CVE-2026-59898, bsc#1272302: protocol version confusion in
io.netty:netty-codec-http (websocket)
+ CVE-2026-56746, bsc#1272255: improper access control in
io.netty:netty-codec-http (CORS)
+ CVE-2026-56822, bsc#1272300: time-of-check/time-of-use in
io.netty:netty-handler-ssl-ocsp
+ GHSA-v74w-7mr3-4qg3, bsc#1272518: uncontrolled resource
consumption in io.netty:netty-codec-xml
+ CVE-2026-56820, bsc#1272259: improper certificate validation
in io.netty:netty-handler-ssl-ocsp
+ CVE-2026-56821, bsc#1272299: improper certificate revocation
check in io.netty:netty-handler-ssl-ocsp
+ CVE-2026-59920, bsc#1272306: improper CR/LF neutrolization in
io.netty:netty-codec-stomp
* Other significant changes:
+ SingleThreadEventExecutor: document Throwable safety contract
on run()
+ Make HTTP/2 frame hashCode consistent with equals
+ Add BlockHound exception for DnsQueryIdSpace (#16896)
+ FlowControlHandler: Fix autoRead behavior
+ Fix incorrect bounds in error message of
HpackDecoder.setMaxHeaderListSize
+ MQTT: Fix MQTT decoder size check after variable header replay
+ MQTT: Make the decodeProperties early-REPLAY check actually
fire
+ Reject control characters at the boundary of HTTP method names
(#16723)
+ Update to latest tcnative release
+ Fix HTTP 2 PUSH_PROMISE stream association validation
+ Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder
+ Add opt-in validation of mandatory pseudo-header fields for
HTTP/2
+ Strictly validate MQTT UTF-8 Encoded String (#16939)
+ Stop DateFormatter trailing token from running past the parse
end
+ IpFilter: Deprecate constructor which use accept by default
+ Add RFC 10008 QUERY Method support (#16966)
+ Correctly release and fail queued traffic-shaping writes on
close (#16959)
+ FlowControlHandler: respect auto-read when toggled while
dequeueing
+ IdleStateHandler: reset firstWriter/ReaderIdleEvent in
resetWriteTimeout/resetReadTimeout (#16982)
+ Fix typo in AbstractSniHandler Javadoc
+ Reconcile AbstractCoalescingBufferQueue readableBytes when it
drains, and fail stuck HTTP/2 streams instead of spinning
empty DATA frames
+ Reject control characters at the boundary of the HTTP version
token (#16971)
+ Reset UTF-8 decode state on CR in StompSubframeDecoder
+ HTTP2: Pass the correct number of arguments when logging
goaway
+ FastLz: Guard decompression against truncated input (#17000)
+ Fix propagation of startTls for client SslContext handler
+ Reject non-token characters in HTTP/2 header names
+ Update lz4-java to 1.11.1
+ Pin github actions to reduce risk (#17043)
+ Merge branches from forks (#17063)
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Upgrade to upstream version 4.1.135
* Security fixes:
+ CVE-2026-48059, bsc#1268258: memory exhaustion in
io.netty:netty-codec-haproxy
+ CVE-2026-47691, bsc#1268252: DNS cache poisoning in
io.netty:netty-resolver-dns
+ CVE-2026-50560, bsc#1268262: DDoS in
io.netty:netty-codec-http2
+ CVE-2026-50011, bsc#1268260: memory exhaustion in
io.netty:netty-codec-redis
+ CVE-2026-44250, bsc#1268169: memory exhaustion in
io.netty:netty-codec-redis
+ CVE-2026-44890, bsc#1268170: memory exhaustion in
io.netty:netty-codec-redis
+ CVE-2026-44249, bsc#1268165: IPv6 subnet filter bypass in
io.netty:netty-handler
+ CVE-2026-50020, bsc#1268261: request smuggling in
io.netty:netty-codec-http
+ CVE-2026-44893, bsc#1268244: memory leak in
io.netty:netty-codec-haproxy
+ CVE-2026-50010, bsc#1268259: TLS hostname verification
accidentally disabled in io.netty:netty-handler
+ CVE-2026-45673, bsc#1268248: DNS cache poisoning in
io.netty:netty-resolver-dns
+ CVE-2026-45416, bsc#1268246: excessive memory usage from
SNIHandler in io.netty:netty-handler
+ CVE-2026-45536, bsc#1268247: file descriptor leak in
io.netty:netty-transport-native-epoll and
io.netty:netty-transport-native-kqueue
+ CVE-2026-45674, bsc#1268249: DNS cache poisoning in
io.netty:netty-resolver-dns
+ CVE-2026-46340, bsc#1268250: memory exhaustion in
io.netty:netty-transport-sctp
+ CVE-2026-47244, bsc#1268251: denial of service in
io.netty:netty-codec-http2
+ CVE-2026-48006, bsc#1268255: memory exhaustion in
io.netty:netty-codec-redis
+ CVE-2026-48043, bsc#1268257: memory exhaustion in
io.netty:netty-codec-http2
* Other significant changes:
+ MQTT: Allow MQTT 5 CONNECT with password only
+ ChannelInitializer: correct misleading comment on
exceptionCaught route
+ HTTP/2: Parse request-target path like Vert.x (4.1 backport)
+ HttpObjectDecoder skips arbitrary initial control characters
when only initial CRLF characters are permitted
+ IpSubnetFilter: Correctly handle ipv6
+ Configurable bound on RedisArrayAggregator
+ Redis: Limit decoded length
+ DNS: Ensure query id is not predictible
+ Wrapping plain trust manager silently disables hostname
verification
+ MQTT: Reject malformed no-payload packets with non-zero
Remaining Length
+ HAProxy: Reject HAProxyMessages with malformated TLV and not
leak memory
+ SSL: Use sane defaults as limits for the client hello length
and timeout
+ DNS: Only cache CNAME if part of the queried domain
+ HTTP/2: Enforce max concurrent streams for misbehaving clients
+ Dns: Insufficient Bailiwick Validation for NS Records
+ HTTP2: DelegatingDecompressorFrameListener must release memory
in all cases
+ Pass maxAllocation to Brotli and Zstd decoders
+ HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory
+ Add maxWindowLog parameter to ZstdDecoder to bound memory
allocation
+ HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs
+ Epoll / Kqueue: Correctly handle receive of FD
+ SCTP: Limit the number of inflight incomplete SCTP messages
and the number of fragments
+ Redis: Correctly release incomplete message on removal when
using RedisArrayAggregator
+ Redis: Limit the maximum number of nested arrays
+ HTTP: Re-add constructor to HttpProxyHandler that was removed
by mistake
+ Marshalling: Explicit document security requirements
+ Pin HTTP/RTSP version + method normalization to Locale.US
+ Adaptive: Fix concurrency issue in adaptive allocator
+ Pin multipart Content-Type / Content-Transfer-Encoding case
folding to Locale.US
+ Remove dead native declarations
+ Avoid re-parsing openssl key material with non-cached provider
+ IpFilter: Fix ClassCastException caused by IpSubnetFilter if
only ipv6 rules are configured but remote peer is using ipv4
+ Resolve all localhost addresses without querying DNS servers
+ HTTP2: Use 100 as default max concurrent streams setting
+ Route synchronous onLookupComplete exceptions via
fireExceptionCaught
+ Fix MQTT decoder size check after variable header replay
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Upgrade to upstream version 4.1.133
* Security fixes:
+ CVE-2026-42586, bsc#1265245 (netty-codec-redis)
+ CVE-2026-42578, bsc#1265243 (netty-handler-proxy)
+ CVE-2026-42587, bsc#1265246 (netty-codec-http,
netty-codec-http2)
+ CVE-2026-41417, bsc#1264350 (netty-codec-http)
+ CVE-2026-42581, bsc#1265277 (netty-codec-http)
+ CVE-2026-42580, bsc#1265273 (netty-codec-http)
+ CVE-2026-42585, bsc#1265292 (netty-codec-http)
+ CVE-2026-42579, bsc#1265272 (netty-codec-dns)
+ CVE-2026-42582 (netty-codec-http3)
+ CVE-2026-42583, bsc#1265279 (netty-codec,
netty-codec-compression)
+ CVE-2026-42584, bsc#1265280 (netty-codec-http)
+ CVE-2026-44248, bsc#1265294 (netty-codec-mqtt)
* Other significant changes:
+ Fix IndexOutOfBoundsException in StompSubframeDecoder on
heartbeat
+ Kqueue: sendfile EINTR doesn't advance offset - data
duplication
+ Avoid leak in PemReader on OutOfDirectMemoryError
+ Native DNS resolver: Guard against malloc failures
+ Include user properties and subscription IDs in
MqttProperties#isEmpty
+ Fix parsing HTTP chunks with multiple extensions
+ Epoll: Cleanup code to always return negative value on failure
+ Native transports: Correctly create pipe when pipe2 is not
supported
+ Use stream error for maxContentLength exceeded in
InboundHttp2ToHttpAdapter
+ Fix shutdownInput bug in kqueue for empty recv buffer
+ Kqueue: Fix usage of LOCAL_PEERPID
+ HTTP2: Ensure HTTP2 preface is always send as first message
+ HTTP2: Ensure HTTP2 preface is always send as first message
(also on the server)
+ Deprecate ObjectCleaner and remove usage
+ Update to netty-tcnative 2.0.77.Final
+ Avoid NPE in JdkSslServerContext when TrustManagerFactory
returns null
+ Avoid NPE in JdkSslClientContext when TrustManagerFactory
returns null
+ SCTP: Correctly handle SO_BACKLOG
- Upgrade to upstream version 4.1.132
* Fixes:
+ Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR
retry loop
+ Make RefCntOpenSslContext.deallocate more robust
+ HTTP2: Correctly account for padding when decompress
+ Fix high-order bit aliasing in HttpUtil.validateToken
+ fix: the precedence of + is higher than >>
+ AdaptiveByteBufAllocator: make sure byteBuf.capacity() not
greater than byteBuf.maxCapacity()
+ AdaptivePoolingAllocator: call unreserveMatchingBuddy(...)
if byteBuf initialization failed
+ Don't assume CertificateFactory is thread-safe
+ Fix HttpObjectAggregator leaving connection stuck after 413
with AUTO_READ=false
+ HTTP2: Ensure preface is flushed in all cases
+ Fix UnsupportedOperationException in readTrailingHeaders
+ Fix client_max_window_bits parameter handling in
permessage-deflate extension
+ Native transports: Fix possible fd leak when fcntl fails.
+ Kqueue: Fix undefined behaviour when GetStringUTFChars fails
and SO_ACCEPTFILTER is supported
+ Kqueue: Possible overflow when using
netty_kqueue_bsdsocket_setAcceptFilter(...)
+ Native transports: Fix undefined behaviour when
GetStringUTFChars fails while open FD
+ Epoll: Add null checks for safety reasons
+ Epoll: Use correct value to initialize mmsghdr.msg_namelen
+ Epoll: Fix support for IP_RECVORIGDSTADDR
+ AdaptivePoolingAllocator: remove ensureAccessible() call in
capacity(int) method
+ Epoll: setTcpMg5Sig(...) might overflow
+ JdkZlibDecoder: accumulate decompressed output before firing
channelRead
+ Limit the number of Continuation frames per HTTP2 Headers
(bsc#1261043, CVE-2026-33871)
+ Stricter HTTP/1.1 chunk extension parsing (bsc#1261031,
CVE-2026-33870)
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Upgrade to upstream version 4.1.131
* Fixes:
+ NioDatagramChannel.block(...) does not early return on failure
+ Support for AWS Libcrypto (AWS-LC) netty-tcnative build
+ codec-dns: Decompress MX RDATA exchange domain names during
DNS record decoding
+ Buddy allocation for large buffers in adaptive allocator
+ SslHandler: Only resume on EventLoop if EventLoop is not
shutting down already
+ Wrap ECONNREFUSED in PortUnreachableException for UDP
+ Bump com.ning:compress-lzf (4.1)
+ Fix adaptive allocator bug from not noticing failed allocation
+ Avoid loosing original read exception
+ Backport multiple adaptive allocator changes
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* no-werror.patch
* reproducible.patch
+ rediff
- Upgrade to upstream version 4.1.130
* Fixes:
+ RLF injection vulnerability in io.netty.handler.codec.http
.HttpRequestEncoder (bsc#1255048, CVE-2025-67735)
+ Update lz4-java version to 1.10.1
+ Close Channel and fail bootstrap when setting a ChannelOption
causes an error
+ Discard the following HttpContent for preflight request
+ Fix race condition in NonStickyEventExecutorGroup causing
incorrect inEventLoop() results
+ Fix Zstd compression for large data
+ Fix ZstdEncoder not producing data when source is smaller than
block
+ Make big endian ASCII hashcode consistent with little endian
+ Fix reentrancy bug in ByteToMessageDecoder
+ Add 32k and 64k size classes to adaptive allocator
+ Re-enable reflective field accesses in native images
+ Correct HTTP/2 padding length check
+ Fix HTTP startline validation
+ Fix MpscIntQueue bug
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Build against the org.jboss:jdk-misc artifact that is implementing the sun.misc classes removed in Java 25
- Upgrade to upstream version 4.1.128
* Fixes
+ BouncyCastleAlpnSslUtils needs to use the correct SSLEngine
class as otherwise it will fail to init static fields
+ SMTP Command Injection Vulnerability Allowing Email Forgery
(bsc#1252097, CVE-2025-59419)
+ Drop unknown frame on missing stream in first packet
+ Precompute segments offsets and use them as segment's
identity
+ Empty chunks cannot be used while allocating from the shared
queue
+ Only register chunk sizes in adaptive allocator
+ Fix concurrent chunk data write bug in adaptive allocator
+ Update jni-util version to clarify licensing
+ Fix Snappy compression bug
+ Fix aligned off-heap zeroing
- Build against the netty-jni-util 0.0.10 sources
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
+ rediff
- Added patch:
* netty-CVE-2021-21295.patch
+ backport of upstream fixes for bsc#1183262, CVE-2021-21295:
HTTP/2 request Content-Length header field is not validated
by 'Http2MultiplexHandler'
- Added patch:
* netty-CVE-2020-11612.patch
+ bsc#1168932, CVE-2020-11612
+ bsc#1169082, CVE-2020-10707
- Split pom-only artifacts into a subpackage netty-pom in order to generate their dependencies correctly
- Initial packaging of netty 4.1.13
- Upgrade to upstream version 4.1.126
* Fixes
+ Decompression codecs vulnerable to DoS via zip bomb style
attack (bsc#1249134, CVE-2025-58057)
+ Request smuggling due to incorrect parsing of chunk extensions
(bsc#1249116, CVE-2025-58056)
+ Fix IllegalReferenceCountException on invalid upgrade response
+ Drop unknown frame on missing stream
+ Don't try to handle incomplete upgrade request
+ Make org.graalvm.nativeimage:svm optional in netty-common
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Upgrade to upstream version 4.1.124
* Fixes
+ MadeYouReset HTTP/2 DDoS vulnerability
(CVE-2025-55163, bsc#1247991)
+ Fix NPE and AssertionErrors when many tasks are scheduled and
cancelled
+ HTTP2: Http2ConnectionHandler should always use
Http2ConnectionEncoder
+ Epoll: Correctly handle UDP packets with source port of 0
+ Fix netty-common OSGi Import-Package header
+ MqttConnectPayload.toString() includes password
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Upgrade to upsteam version 4.1.123
* Fixes
+ Fix chunk reuse bug in adaptive allocator
+ More accurate adaptive memory usage accounting
+ Introduce size-classes for the adaptive allocator
+ Reduce magazine proliferation eagerness
+ Fix concurrent ByteBuffer access issue in
AdaptiveByteBuf.getBytes
+ Fix possible buffer corruption caused by incorrect
setCharSequence(...) implementation
+ AdaptiveByteBuf: Fix AdaptiveByteBuf.maxFastWritableBytes()
to take writerIndex() into account
+ Optimize capacity bumping for adaptive ByteBufs
+ AbstractDnsRecord: equals() and hashCode() to ignore name
field's case
+ Backport Unsafe guards
+ Guard recomputed offset access with hasUnsafe
+ HTTP2: Always produce a RST frame on stream exception
+ Correct what artifacts included in netty-bom
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Upgrade to upstream version 4.1.122
* Fixes of 4.1.122
+ DirContextUtils.addNameServer(...) should just catch Exception
internally
+ Make public API specify explicit maxAllocation to prevent OOM
+ Fix concurrent ByteBuf write access bug in adaptive allocator
+ Fix transport-native-kqueue Bundle-SymbolicNames
+ Fix resolver-dns-native-macos Bundle-SymbolicNames
+ Always correctly calculate the memory address of the ByteBuf
even if sun.misc.Unsafe is not usable
+ Upgrade lz4 dependencies as the old version did not correctly
handle ByteBuffer that have an arrayOffset > 0
+ Optimize ByteBuf.setCharSequence for adaptive allocator
+ Kqueue: Fix registration failure when fd is reused
+ Make JdkZlibEncoder accept Deflater.DEFAULT_COMPRESSION as
level
+ Ensure OpenSsl.availableJavaCipherSuites does not contain null
values
+ Always prefer direct buffers for pooled allocators if not
explicit disabled
+ Update to netty-tcnative 2.0.72.Final
+ Re-enable sun.misc.Unsafe by default on Java 24+
+ Kqueue: Delay removal from registration map to fix noisy
warnings
* Fixes of 4.1.121
+ Epoll.isAvailable() returns false on Ubuntu 20.04/22.04 arch
amd64
+ Fix transport-native-epoll Bundle-SymbolicNames
* Fixes of 4.1.120
+ Fix flawed termination condition check in
HttpPostRequestEncoder#encodeNextChunkUrlEncoded(int) for
current InterfaceHttpData
+ Exposed decoderEnforceMaxConsecutiveEmptyDataFrames and
decoderEnforceMaxRstFramesPerWindow
+ ThreadExecutorMap must restore old EventExecutor
+ Make Recycler virtual thread friendly
+ Disable sun.misc.Unsafe by default on Java 24+
+ Adaptive: Correctly enforce leak detection when using
AdaptiveByteBufAllocator
+ Add suppressed exception to original cause when calling
Future.sync*
+ Add SETTINGS_ENABLE_CONNECT_PROTOCOL to the default HTTP/2
settings
+ Correct computation for suboptimal chunk retirement
probability
+ Fix bug in method
AdaptivePoolingAllocator.allocateWithoutLock(...)
+ Fix a Bytebuf leak in TcpDnsQueryDecoder
+ SSL: Clear native error if named group is not supported
+ WebSocketClientCompressionHandler shouldn't claim window bits
support when jzlib is not available
+ Fix the assignment error of maxQoS parameter in ConnAck
Properties
* Fixes of 4.1.119
+ Replace SSL assertion with explicit record length check
+ Fix NPE when upgrade message fails to aggregate
+ SslHandler: Fix possible NPE when executor is used for
delegating
+ Consistently add channel info in HTTP/2 logs
+ Add QueryStringDecoder option to leave '+' alone
+ Use initialized BouncyCastle providers when available
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Fix pom.xml errors that will be fatal with Maven 4
- Upgrade to upstream version 4.1.118
* Fixes of 4.1.118
+ SslHandler doesn't correctly validate packets which can lead
to native crash when using native SSLEngine (bsc#1237037,
CVE-2025-24970)
+ Denial of Service attack on windows app using Netty, again
(bsc#1237038, CVE-2025-25193)
+ Upgrade netty-tcnative to 2.0.70.Final
+ Fix recycling in CodecOutputList
+ Allocate bytebuf without magazine lock when threads get
collisions
+ Make StreamBufferingEncoder not send header frame with
priority by default
+ Notify event loop termination future of unexpected exceptions
+ KQueueEventLoop leaks memory on shutdown
+ Fix AccessControlException in GlobalEventExecutor
+ Fix possible buffer leak when stream can't be mapped
+ AdaptivePoolingAllocator: Round chunk sizes up to
MIN_CHUNK_SIZE units and reduce chunk release frequency
* Fixes of 4.1.117
+ Fix classloader leaks in GlobalEventExecuto
+ Support BouncyCastle FIPS for reading PEM files
+ Dns: Correctly encode DnsPtrRecord
+ Provides Brotli settings without com.aayushatharva.brotli4j
dependency
+ Make DefaultResourceLeak more resilient against OOM
+ OpenSslSession: Add support to defensively check for peer
certs
+ Reentrant close in EmbeddedChannel
+ SslHandler: Ensure buffers are never leaked when wrap(...)
produce SSLException
+ Adaptive: Only use ThreadLocal if called from
FastThreadLocalThread in case of temporary byte[] allocation
+ Correcly handle comments appended to nameserver declarations
* Fixes of 4.1.116
+ PcapWriteHandler no longer ignores writePcapGlobalHeader
+ Allow PcapWriteHandler to output PCAP files larger than 2GB
+ Fix bugs in BoundedInputStream
+ AdaptiveByteBufAllocator will not use threadlocal magazine if
FastThreadLocalThread.willCleanupFastThreadLocals() returns
false
+ Fix HTTP header validation bug
+ Add range check for
AdaptivePoolingAllocator.CENTRAL_QUEUE_CAPACITY and
MAGAZINE_BUFFER_QUEUE_CAPACITY
+ Fix possible race condition in method
AdaptivePoolingAllocator.offerToQueue(...)
+ Make sure the sentinel Magazine.MAGAZINE_FREED not be replaced
+ Decrease usedMemory of magazine when the chunk get deallocate
+ Only try to use Zstd and Brotli if we can load the native libs
+ AdaptiveByteBufAllocator: Correctly manage used memory
strategy in all cases
+ Bump BlockHound version to 1.0.10.RELEASE
+ Add details to TooLongFrameException message
+ Adapt: Only add Chunk to central Queue if unused
+ Adapt: Don't fail when we run on a host with 1 core
+ Adapt: Ensure Chunks from the central Queue are re-used even
if there are Magazine local cached Chunks
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
- Upgrade to upstream version 4.1.115
* Fixes:
+ Allow MessageToMessageDecoder to take care of reading more
data when needed
+ Fix SSL session resumption with ClientAuth.OPTIONAL and add
tests with session tickets
+ Fix incorrect cast in NioDomainSocketChannel.parent()
+ Fix bug where SslHandler may stall after TLSv1.3 handshake
with delegate tasks
+ AdaptiveByteBufAllocator: Make pooling of AdaptiveByteBuf
magazine local
+ Specialize Adaptive's allocator Recycler based on magazine's
owner
+ Fix epoll_wait retry loop
+ Log / include the correct error during handshake failure
+ Convey autoAckPing in http2 decoder constructor chain
+ Allow to set used named groups per OpenSslContext
+ Verify default named groups before using them with native SSL
implementation
+ Include details on why it was not possible to configure
accepted issuers in the SSLException
+ Correctly detect if KeyManager is not supported by OpenSSL
version
+ Preserve ordering of default named groups during conversation
+ Denial of Service attack on windows app using netty
(bsc#1233297, CVE-2024-47535)
- Split the netty-poms package in netty-parent and netty-bom
- Modified patch:
* 0001-Remove-optional-dep-Blockhound.patch
+ rediff
- Clean a bit the spec file and adapt to the recent changes in
netty-tcnative package
- Removed patches:
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
+ remove the annotations with a macro in the jurand tool
* 0007-Do-not-require-the-tcnative-native-library.patch
+ we are building now the artifact, so we can require it
- Upgrade to upstream version 4.1.114
* Fixes of 4.1.114:
+ Validate HTTP Method
+ Release AdaptiveByteBuf when ownership could not be transfered
+ Make arenas reuse their last chunk more aggressively
+ Only add Magazine to Set if we can ensure its removed again
+ Ensure Chunk will not leak if init of AdaptiveByteBuf fails
for whatever reason
+ Correctly release one-off allocated chunks
+ Ensure pooled memory is released when
AdaptivePoolingAllocator is GC'ed
+ Slices / duplicates of AdaptiveByteBuf must not escape the
rootParent
+ Fix sizeBucket bug in AdaptivePoolingAllocator
+ AdaptiveByteBufAllocator: More strict reference counting for
chunks
+ Ensure we not store the DnsQueryContext for later removal when
we couldnt obtain a query id
+ Reduce memory fragmentation
+ Properly free magazine chunks and avoid orphaned magazines
+ Magazines must be freed under the expand lock
+ Release message before failing promise when multiple requests
are written while upgrade is in progress.
+ Allow to reuse more then one session per host / port mapping
+ Ensure writes will not fail when triggered after receiving
UpgradeEvent.UPGRADE_SUCCESSFUL
+ Refactor DnsNameResolver to be able to use different
strategies when it comes to creating Channels for queries.
+ DnsNameResolver: allow users to skip bind() during bootstrap
+ DnsResolverBuilder methods should make it clear that these are
for DatagramChannel
* Fixes of 4.1.113:
+ feat: Support for IP_BIND_ADDRESS_NO_PORT socket option
+ Ensure AbstractCoalescingBufferQueue does not end up in
inconsistent state on error
+ Add new SslHandler.isEncrypted(...) variant that will not
produce false positives
+ Ensure flushes are not discarded by ChunkedWriteHandler for
passed through messages
+ Remove reference to parent in recycled buffers for leak
detection
+ Upgrade to netty-tcnative 2.0.66.Final
+ Cleanup fields on AdaptiveByteBuf::deallocate
* Fixes of 4.1.112:
+ Avoid unnecessary reflective probes on netty initialization
+ Allow control frames between fragments
+ Only delete the socket file for NioServerDomainSocketChannel
+ Add check for IPv6 brackets when address is unresolved
+ fix ResolvConf initialization with SecurityManager enabled
+ Fix potential DNS cache invalidation in
ResolveWithDotSearchDomain scenario
+ Backport the SslContextBuilder.endpointIdentificationAlgorithm
method
+ Aggressively remove PoolThreadCache references from its
finalizer object
+ Send Http2PriorityFrame through fireUserEventTriggered for
Http2MultiplexHandler
+ Fix potential DNS cache invalidation across different
EventLoops
+ Reject http header values with non SP / HTAB chars
+ Don't strip whitespaces from header names and let the
validator handle it
+ Reject request if NUL is present in the request line
+ Allow HTTP responses without reason-phrase
+ Validate HTTP version while decoding
+ Only include scopeId on link-local addresses when using native
transport
* Fixes of 4.1.111:
+ ReadOnlyByteBufferBuf | ReadOnlyUnsafeDirectByteBuf get, copy,
duplicate, slice methods should be safe to be called from
multiple threads
+ ReadyOnlyBuf must return false for isWritable() when sliced or
duplicated
+ ReadOnlyByteBuf (and sub-classes) does not create derived
buffers that share reference count
+ ByteBuf.asReadOnly().nioBuffer*() need to return read-only
ByteBuffer
+ Remove unwanted mandatory dependency in OSGi
+ HashedWheelTimer.stop() must cancel tasks
+ ZSTD decompression not resilient to compression bombs
+ Duplicate of slice should have the same capacity as the
original slice so that it's not writable
+ Optimize wrap buffer cumulation in SslHandler and don't mutate
input buffers
+ Prepare for unsafe memory access deprecated for removal
+ Fix AdaptiveByteBufAllocator class loading on Java 6/7
+ Add missing NULL checks in native code
* Fixes of 4.1.110:
+ Add unix domain socket transport in netty 4.x via JDK16+
+ Backport #13075: Add the AdaptivePoolingAllocator
+ Add no-value key handling only for form body
+ Add support for specifying SecureRandom in SSLContext
initialization
* Fixes of 4.1.109:
+ Utilize ByteBuf#indexOf
+ Don't send a RST frame when closing the stream in a write
future while processing inbound frames
+ Fix DefaultChannelId#asLongText NPE
+ Fix voidPromise in Http2FrameCodec.writeHeadersFrame
+ Make /etc/resolv.conf reading more robust
+ Fix NioSocketChannel usage in graalvm native-image
+ Improve ByteBufUtil#firstIndexOf
+ Rewrite ZstdDecoder to remove the need of allocate a huge
byte[] internally
+ Always log registered/detected ChannelInitializerExtension(s)
at INFO level
+ Enhance AsciiString#toLowerCase and AsciiString#toUpperCase
+ Add support for zstd http content decompression
+ Save Snappy's encode tmp table allocation
- Regenerated patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
* 0007-Do-not-require-the-tcnative-native-library.patch
- Add reproducible.patch to omit the mtime from libnetty-unix-common.a for reproducible builds (boo#1047218)
- Upgrade to upstream version 4.1.108
* Fixes of 4.1.108:
+ HttpPostRequestDecoder can OOM (bsc#1222045, CVE-2024-29025)
+ Add zstd decoder
+ Updated HTTP2 Reader to fix missing header state
+ codec-http2: fix some frame validation errors
+ SSL: Only wrap TrustManager if FIPS is not used
+ Epoll: Correctly handle splice tasks when Channel is closed
+ Allow to cancel connect() operations when using non-blocking
IO
+ DNS resolver final CNAME lookup disabled
+ DNS: Add DnsRecordType definitions for SVCB and HTTPS
+ SSL: Only try to use TLSv1.3 if a compatible ciphersuite is
configured
+ Backport 'Fix buffer leak in DefaultHttp2HeadersEncoder' to v4
+ SSL: Hold the right monitor while running delegating task
+ SSL: Execute SSL_do_handshake(...) after task is run to ensure
SSLEngine.getHandshakeStatus() returns the correct value all
the time
+ Add active flag to EpollServerDomainSocketChannel fd
constructor
+ Epoll: Fix possible Classloader deadlock caused by loading
class via JNI
+ Prefer /etc/resolv.conf on Linux and Mac
+ Handle invalid cookie value
+ Upgrade to latest tcnative release
+ ByteToMessageDecoder.channelReadComplete(...) does call read()
too often
+ Remove the lock usage in PoolArena#numPinnedBytes()
+ Fix x-www-form-urlencoded parsing for no-value key
(re-submission)
* Fixes of 4.1.107:
+ Speedup pseudoheader lookup
+ Add support for the Partitioned attribute in cookies
+ Reduce HTTP 1.1 Full msg pipeline traversals
+ DnsNameResolver: Add DnsQueryIdSpace class to reduce overhead
while generating IDs
+ Fix copy-paste mistake in
LazyX509Certificate.getIssuerAlternativeNames()
+ HTTP2: lastStreamCreated() does return the wrong value when
all stream ids were used
+ HTTP2: Update local window should not fail queued frames
+ DnsNameResolver: Allways call bind() during bootstrap
+ HTTP: HttpObjectDecoder must not use HTTPMessage once it is
passed to the next handler in the ChannelPipeline
+ Ensure key / values are shared between resumed sessions
+ SSLSession.getLastAccessedTime() and getCreationTime() should
not be equal when session is reused
+ Snappy: Use unsigned short to handle 2 ^ 16 input size instead
of 2 ^ 15
* Fixes of 4.1.106:
+ HTTP2: Prevent sharing the index of the continuation frame
header ByteBuf.
+ DnsNameResolver: Fail query if id space is exhausted
+ Short-circuit ByteBuf::release
* Fixes of 4.1.105:
+ Fix exception on HTTP chunk size overflow
+ Default value of MAX_MESSAGES_PER_READ not used for native
DatagramChannels
+ Redo fix scalability issue due to checkcast on context's
invoke operations
+ Be able to retry the query via TCP if a query failed because
of a timeout
+ Save HTTP 2 pseudo-header lower-case validation
+ DnsNameResolver: Limit connect timeout to query timeout
+ h2: propagate stream close without read pending, avoid SOOE
if !autoRead
* Fixes of 4.1.104:
+ dyld: Symbol not found: _netty_jni_util_JNI_OnLoad
* Fixes of 4.1.103:
+ Workaround for regex bug in Android SDK
+ Use Http2Headers.size() instead of isEmpty()
+ Add support for RISC-V
* Fixes of 4.1.101:
+ Add service-loaded extension points for channel initialization
+ Added check for pseudo-headers in trailers
+ Automatically close Http2StreamChannel when
Http2FrameStreamExceptionreaches end ofChannelPipeline
+ Throwing a stackless exception if RST_FRAME rate is exceeded
+ Only enable the RST limit for servers by default
+ Change default value of MAX_MESSAGES_PER_READ for
DatagramChannel implementations
+ Descriptive message for errors related to unknown http2
streams
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
* 0007-Do-not-require-the-tcnative-native-library.patch
+ rebase
- Use %patch -P N instead of deprecated %patchN.
- Upgrade to upstream version 4.1.100
* Fixes of 4.1.100:
+ DDoS vector in the HTTP/2 protocol due RST frames
(bsc#1216169, CVE-2023-44487)
+ Do not fail when compressing empty HttpContent
* Fixes of 4.1.99:
+ Do not try to delete a global handle with the local handles
APIs
+ Enable build with JDK21
+ dyld: lazy symbol binding failed: Symbol not found:
_netty_jni_util_JNI_OnLoad
* Fixes of 4.1.98:
+ Revert "HttpHeaderValidationUtil should reject chars past the
1 byte range"
+ Filter out unresolved addresses when parsing resolv.conf
+ Prevent classloader leak via JNI
+ SSLSession.getPeerCertificateChain() should throw
UnsupportedOperationException if javax.security.cert
.X509Certificate can not be created
+ Enable client side session cache when using native SSL by
default
* Fixes of 4.1.97:
+ Fixing AsciiString#lastIndexOf To Respect The offset
+ Add support for snappy http2 content decompression
+ Add support for password-based encryption scheme 2 params
+ HttpHeaderValidationUtil should reject chars past the 1 byte
range
+ Honor SslHandler.setWrapDataSize greater than SSL packet
length
+ Add support for snappy http content encoding
* Fixes of 4.1.96:
+ Move the PoolThreadCache finalizer to a separate object
+ Fix kevent(..) failed: Invalid argument
+ Revert "Always increment Stream Id on createStream" to fix bug
which caused sending multiple RST frames for the same id
* Fixes of 4.1.95
+ Add resource leak listener
+ Reduce object allocations during SslHandler.flush(...)
+ Ensure ByteBuf.capacity(...) will never throw AssertionError
+ Make transport.Bootstrap usable with no netty-resolver on
classpath
+ Correctly retain slice when calling
ReplayingDecoderByteBuf.retainedSlice(...)
+ Always increment Stream Id on createStream(...)
+ Fix BrotliEncoder bug that does not mark ByteBuf it encodes a
read
+ Enhance CertificateException message when throw due hostname
validation
- Rebased patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
* 0007-Do-not-require-the-tcnative-native-library.patch
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp